How Tracking Companies Circumvented Ad Blockers Using WebSockets - - PowerPoint PPT Presentation

▶
how tracking companies circumvented ad blockers using
SMART_READER_LITE
LIVE PREVIEW

How Tracking Companies Circumvented Ad Blockers Using WebSockets - - PowerPoint PPT Presentation

Sep 08, 2022 300 likes •1.11k views

How Tracking Companies Circumvented Ad Blockers Using WebSockets Muhammad Ahmad Bashir, Sajjad Arshad, Engin Kirda, William Robertson, Christo Wilson Northeastern University Online Tracking 2 Online Tracking Surge in online

slide-1
SLIDE 1

How Tracking Companies Circumvented Ad Blockers Using WebSockets

Muhammad Ahmad Bashir, Sajjad Arshad, Engin Kirda, William Robertson, Christo Wilson
 


Northeastern University

slide-2
SLIDE 2

Online Tracking

2

slide-3
SLIDE 3

Online Tracking

Surge in online advertising (internet economy)

  • Ad networks pour in billions of dollars.
  • Value for their investment?
  • Extensive tracking to serve targeted ads.

2

slide-4
SLIDE 4

Online Tracking

Surge in online advertising (internet economy)

  • Ad networks pour in billions of dollars.
  • Value for their investment?
  • Extensive tracking to serve targeted ads.

2

User concern over tracking

  • Led to the proliferation of ad blocking extensions
slide-5
SLIDE 5

Online Tracking

Surge in online advertising (internet economy)

  • Ad networks pour in billions of dollars.
  • Value for their investment?
  • Extensive tracking to serve targeted ads.

2

User concern over tracking

  • Led to the proliferation of ad blocking extensions

Ad networks fight back

  • E.g Using anti ad blocking scripts
slide-6
SLIDE 6

Google & Safari

  • Google evaded Safari’s third-party cookie blocking policy

(Jonathan Mayer)

  • … by submitting a form in an invisible iFrame
  • Google was fined $22.5M by FTC

3

slide-7
SLIDE 7

This Talk

How Ad Networks leveraged a bug in Chrome API to bypass Ad Blockers using WebSockets

4

slide-8
SLIDE 8

This Talk

How Ad Networks leveraged a bug in Chrome API to bypass Ad Blockers using WebSockets

4

  • 1. What caused this?
  • 2. How this bug was leveraged by ad networks?
slide-9
SLIDE 9

Web Sockets

5

slide-10
SLIDE 10

Web Sockets

5

HTTP/S

slide-11
SLIDE 11

Web Sockets

5

HTTP/S

request response

slide-12
SLIDE 12

Web Sockets

5

HTTP/S

request response

Chatting App

slide-13
SLIDE 13

Web Sockets

5

HTTP/S

request response

Chatting App

anything new?

slide-14
SLIDE 14

Web Sockets

5

HTTP/S

request response

Chatting App

anything new?

Web Socket

slide-15
SLIDE 15

Web Sockets

5

HTTP/S

request response

Chatting App

anything new?

Web Socket

bidirectional

  • Both client and server can send/receive data
  • This is a persistent connection
slide-16
SLIDE 16

Web Sockets

5

HTTP/S

request response

Chatting App

anything new?

Web Socket

bidirectional ws:// or wss://

  • Both client and server can send/receive data
  • This is a persistent connection
slide-17
SLIDE 17

Ad Blockers

6

slide-18
SLIDE 18

Ad Blockers

6

  • Chrome extension chrome.webRequest API
  • Extension can inspect / modify / drop outgoing requests
slide-19
SLIDE 19

Ad Blockers

6

  • Chrome extension chrome.webRequest API
  • Extension can inspect / modify / drop outgoing requests

webRequest API

slide-20
SLIDE 20

Ad Blockers

6

  • Chrome extension chrome.webRequest API
  • Extension can inspect / modify / drop outgoing requests

http://cnn.com/logo.jpeg

webRequest API

slide-21
SLIDE 21

Ad Blockers

6

  • Chrome extension chrome.webRequest API
  • Extension can inspect / modify / drop outgoing requests

http://cnn.com/logo.jpeg

webRequest API Rule List

Usually borrowed 
 from EasyList

slide-22
SLIDE 22

Ad Blockers

6

  • Chrome extension chrome.webRequest API
  • Extension can inspect / modify / drop outgoing requests

http://cnn.com/logo.jpeg

webRequest API Rule List

url

Usually borrowed 
 from EasyList

slide-23
SLIDE 23

Ad Blockers

6

  • Chrome extension chrome.webRequest API
  • Extension can inspect / modify / drop outgoing requests

http://cnn.com/logo.jpeg

webRequest API Rule List

url

Usually borrowed 
 from EasyList

slide-24
SLIDE 24

Ad Blockers

6

  • Chrome extension chrome.webRequest API
  • Extension can inspect / modify / drop outgoing requests

http://cnn.com/logo.jpeg

webRequest API Rule List

url

Usually borrowed 
 from EasyList

slide-25
SLIDE 25

Ad Blockers

6

  • Chrome extension chrome.webRequest API
  • Extension can inspect / modify / drop outgoing requests

http://cnn.com/logo.jpeg

webRequest API Rule List

url

webRequest API

Usually borrowed 
 from EasyList

slide-26
SLIDE 26

Ad Blockers

6

  • Chrome extension chrome.webRequest API
  • Extension can inspect / modify / drop outgoing requests

http://cnn.com/logo.jpeg

webRequest API Rule List

http://doubleclick.com/s1.js url

webRequest API

Usually borrowed 
 from EasyList

slide-27
SLIDE 27

Ad Blockers

6

  • Chrome extension chrome.webRequest API
  • Extension can inspect / modify / drop outgoing requests

http://cnn.com/logo.jpeg

webRequest API Rule List

http://doubleclick.com/s1.js url

webRequest API

url

Usually borrowed 
 from EasyList

slide-28
SLIDE 28

Ad Blockers

6

  • Chrome extension chrome.webRequest API
  • Extension can inspect / modify / drop outgoing requests

http://cnn.com/logo.jpeg

webRequest API Rule List

http://doubleclick.com/s1.js url

webRequest API

url

Usually borrowed 
 from EasyList

slide-29
SLIDE 29

Ad Blockers

6

  • Chrome extension chrome.webRequest API
  • Extension can inspect / modify / drop outgoing requests

http://cnn.com/logo.jpeg

webRequest API Rule List

http://doubleclick.com/s1.js url

webRequest API

url

Usually borrowed 
 from EasyList

slide-30
SLIDE 30

AdBlock Evasion

7

slide-31
SLIDE 31

AdBlock Evasion

  • Bug in
  • ws/wss requests did not trigger the API

7

webRequest API

slide-32
SLIDE 32

AdBlock Evasion

  • Bug in
  • ws/wss requests did not trigger the API

7

2012 2013 2014 2015 2016 2017 2018

webRequest API

slide-33
SLIDE 33

AdBlock Evasion

  • Bug in
  • ws/wss requests did not trigger the API

7

2012 2013 2014 2015 2016 2017 2018

Original bug
 reported

webRequest API

slide-34
SLIDE 34

AdBlock Evasion

  • Bug in
  • ws/wss requests did not trigger the API

7

2012 2013 2014 2015 2016 2017 2018

Original bug
 reported Users report 
 unblocked ads

webRequest API

slide-35
SLIDE 35

AdBlock Evasion

  • Bug in
  • ws/wss requests did not trigger the API

7

2012 2013 2014 2015 2016 2017 2018

Original bug
 reported Users report 
 unblocked ads Patch Finalized 
 ( Landed)

webRequest API

slide-36
SLIDE 36

AdBlock Evasion

  • Bug in
  • ws/wss requests did not trigger the API

7

2012 2013 2014 2015 2016 2017 2018

Original bug
 reported Users report 
 unblocked ads Patch Finalized 
 ( Landed) Chrome 58
 released

webRequest API

slide-37
SLIDE 37

AdBlock Evasion

  • Bug in
  • ws/wss requests did not trigger the API

7

2012 2013 2014 2015 2016 2017 2018

* * * *

Original bug
 reported Users report 
 unblocked ads Patch Finalized 
 ( Landed) Chrome 58
 released

* Represents when our crawls were done

webRequest API

slide-38
SLIDE 38

Data Crawling

8

slide-39
SLIDE 39

Data Crawling

8

100K websites 
 sampled from Alexa

slide-40
SLIDE 40

Data Crawling

8

100K websites 
 sampled from Alexa

Visit 15 
 links / website

Collected chains for all included resources

slide-41
SLIDE 41

Data Crawling

8

100K websites 
 sampled from Alexa

Visit 15 
 links / website

Collected chains for all included resources

This means we know which resource included which other resource

slide-42
SLIDE 42

Data Crawling

8

100K websites 
 sampled from Alexa

Visit 15 
 links / website

Collected chains for all included resources Filter all resources which end in 
 web sockets

Filter 
 WebSockets

This means we know which resource included which other resource

slide-43
SLIDE 43

Data Crawling

8

100K websites 
 sampled from Alexa

Visit 15 
 links / website

Collected chains for all included resources Filter all resources which end in 
 web sockets

Filter 
 WebSockets Detect A&A 
 WebSockets

Mark web sockets
 which are used by A&A domains

A&A = Advertising and Analytics e.g. DoubleClick, Criteo, Adnxs This means we know which resource included which other resource

slide-44
SLIDE 44

Data Crawling

8

100K websites 
 sampled from Alexa

Visit 15 
 links / website

Collected chains for all included resources Filter all resources which end in 
 web sockets

Filter 
 WebSockets Detect A&A 
 WebSockets

Mark web sockets
 which are used by A&A domains

A&A = Advertising and Analytics e.g. DoubleClick, Criteo, Adnxs This means we know which resource included which other resource

pub/ index.html srv.ws ads/ script.js ads/ frame.html ads/ img_a.jpg adnet/ data.ws

Example Inclusion Tree

slide-45
SLIDE 45

Data Crawling

8

100K websites 
 sampled from Alexa

Visit 15 
 links / website

Collected chains for all included resources Filter all resources which end in 
 web sockets

Filter 
 WebSockets Detect A&A 
 WebSockets

Mark web sockets
 which are used by A&A domains

A&A = Advertising and Analytics e.g. DoubleClick, Criteo, Adnxs This means we know which resource included which other resource

pub/ index.html srv.ws ads/ script.js ads/ frame.html ads/ img_a.jpg adnet/ data.ws

Example Inclusion Tree

WebSocket WebSocket

slide-46
SLIDE 46

Data Crawling

8

100K websites 
 sampled from Alexa

Visit 15 
 links / website

Collected chains for all included resources Filter all resources which end in 
 web sockets

Filter 
 WebSockets Detect A&A 
 WebSockets

Mark web sockets
 which are used by A&A domains

A&A = Advertising and Analytics e.g. DoubleClick, Criteo, Adnxs This means we know which resource included which other resource

pub/ index.html srv.ws ads/ script.js ads/ frame.html adnet/ data.ws

Example Inclusion Tree

WebSocket WebSocket

slide-47
SLIDE 47

Data Crawling

8

100K websites 
 sampled from Alexa

Visit 15 
 links / website

Collected chains for all included resources Filter all resources which end in 
 web sockets

Filter 
 WebSockets Detect A&A 
 WebSockets

Mark web sockets
 which are used by A&A domains

A&A = Advertising and Analytics e.g. DoubleClick, Criteo, Adnxs This means we know which resource included which other resource

pub/ index.html ads/ script.js ads/ frame.html adnet/ data.ws

Example Inclusion Tree

WebSocket

slide-48
SLIDE 48

High-Level Numbers

9

slide-49
SLIDE 49

High-Level Numbers

9

Crawl Dates %Websites 
 with sockets % Sockets
 with A&A
 Initiators % Sockets
 with A&A
 Receivers #Unique A&A
 Initiators #Unique A&A
 Receivers Apr 02-05, 2017 2.1 60.6 73.7 75 16 Apr 11-16, 2017 2.4 61.3 74.6 63 18 May 07-12, 2017 1.6 60.2 69.7 19 15 Oct 12-16, 2017 2.5 63.4 63.7 23 18 Before 
 Chrome 58

slide-50
SLIDE 50

High-Level Numbers

9

Crawl Dates %Websites 
 with sockets % Sockets
 with A&A
 Initiators % Sockets
 with A&A
 Receivers #Unique A&A
 Initiators #Unique A&A
 Receivers Apr 02-05, 2017 2.1 60.6 73.7 75 16 Apr 11-16, 2017 2.4 61.3 74.6 63 18 May 07-12, 2017 1.6 60.2 69.7 19 15 Oct 12-16, 2017 2.5 63.4 63.7 23 18 Before 
 Chrome 58 After 
 Chrome 58

slide-51
SLIDE 51

High-Level Numbers

9

Crawl Dates %Websites 
 with sockets % Sockets
 with A&A
 Initiators % Sockets
 with A&A
 Receivers #Unique A&A
 Initiators #Unique A&A
 Receivers Apr 02-05, 2017 2.1 60.6 73.7 75 16 Apr 11-16, 2017 2.4 61.3 74.6 63 18 May 07-12, 2017 1.6 60.2 69.7 19 15 Oct 12-16, 2017 2.5 63.4 63.7 23 18

  • ~2% websites use web sockets.

Before 
 Chrome 58 After 
 Chrome 58

slide-52
SLIDE 52

High-Level Numbers

9

Crawl Dates %Websites 
 with sockets % Sockets
 with A&A
 Initiators % Sockets
 with A&A
 Receivers #Unique A&A
 Initiators #Unique A&A
 Receivers Apr 02-05, 2017 2.1 60.6 73.7 75 16 Apr 11-16, 2017 2.4 61.3 74.6 63 18 May 07-12, 2017 1.6 60.2 69.7 19 15 Oct 12-16, 2017 2.5 63.4 63.7 23 18

  • ~2% websites use web sockets.
  • ~61 % sockets are initiated by A&A domains

Before 
 Chrome 58 After 
 Chrome 58

A&A = Advertising and Analytics e.g. DoubleClick, Criteo, Adnxs

slide-53
SLIDE 53

High-Level Numbers

9

Crawl Dates %Websites 
 with sockets % Sockets
 with A&A
 Initiators % Sockets
 with A&A
 Receivers #Unique A&A
 Initiators #Unique A&A
 Receivers Apr 02-05, 2017 2.1 60.6 73.7 75 16 Apr 11-16, 2017 2.4 61.3 74.6 63 18 May 07-12, 2017 1.6 60.2 69.7 19 15 Oct 12-16, 2017 2.5 63.4 63.7 23 18

  • ~2% websites use web sockets.
  • ~61 % sockets are initiated by A&A domains
  • ~71 % sockets contact an A&A domain

Before 
 Chrome 58 After 
 Chrome 58

A&A = Advertising and Analytics e.g. DoubleClick, Criteo, Adnxs

slide-54
SLIDE 54

High-Level Numbers

9

Crawl Dates %Websites 
 with sockets % Sockets
 with A&A
 Initiators % Sockets
 with A&A
 Receivers #Unique A&A
 Initiators #Unique A&A
 Receivers Apr 02-05, 2017 2.1 60.6 73.7 75 16 Apr 11-16, 2017 2.4 61.3 74.6 63 18 May 07-12, 2017 1.6 60.2 69.7 19 15 Oct 12-16, 2017 2.5 63.4 63.7 23 18

  • ~2% websites use web sockets.
  • ~61 % sockets are initiated by A&A domains
  • ~71 % sockets contact an A&A domain
  • # Initiators drop after Chrome 58 release.

Before 
 Chrome 58 After 
 Chrome 58

A&A = Advertising and Analytics e.g. DoubleClick, Criteo, Adnxs

slide-55
SLIDE 55

High-Level Numbers

9

Crawl Dates %Websites 
 with sockets % Sockets
 with A&A
 Initiators % Sockets
 with A&A
 Receivers #Unique A&A
 Initiators #Unique A&A
 Receivers Apr 02-05, 2017 2.1 60.6 73.7 75 16 Apr 11-16, 2017 2.4 61.3 74.6 63 18 May 07-12, 2017 1.6 60.2 69.7 19 15 Oct 12-16, 2017 2.5 63.4 63.7 23 18

  • ~2% websites use web sockets.
  • ~61 % sockets are initiated by A&A domains
  • ~71 % sockets contact an A&A domain
  • # Initiators drop after Chrome 58 release.
  • Small but persistent A&A receivers.

Before 
 Chrome 58 After 
 Chrome 58

A&A = Advertising and Analytics e.g. DoubleClick, Criteo, Adnxs

slide-56
SLIDE 56

Initiators and Receivers

10

slide-57
SLIDE 57

Initiators and Receivers

10

Initiator Receiver

JavaScript

slide-58
SLIDE 58

Initiators and Receivers

10

Initiator Receiver ws/s

JavaScript

slide-59
SLIDE 59

Initiators and Receivers

10

Initiator Receiver ws/s

JavaScript

slide-60
SLIDE 60

Initiators and Receivers

10

A&A Initiator #A&A
 Receivers facebook 11 google 11 doubleclick 9 youtube 8 addthis 8 hotjar 7 googlesyndication 6 twitter 5 sharethis 4 adnxs 3

Top A&A 
 Initiators

Initiator Receiver ws/s

JavaScript

slide-61
SLIDE 61

Initiators and Receivers

10

A&A Initiator #A&A
 Receivers facebook 11 google 11 doubleclick 9 youtube 8 addthis 8 hotjar 7 googlesyndication 6 twitter 5 sharethis 4 adnxs 3

Top A&A 
 Initiators

Initiator Receiver ws/s

JavaScript

slide-62
SLIDE 62

Initiators and Receivers

10

A&A Initiator #A&A
 Receivers facebook 11 google 11 doubleclick 9 youtube 8 addthis 8 hotjar 7 googlesyndication 6 twitter 5 sharethis 4 adnxs 3 A&A Receiver #A&A
 Initiators realtime 27 33across 19 intercom 16 disqus 13 zopim 12 hotjar 11 feedjit 10 lockerdome 8 inspectlet 6 smartsupp 4

Top A&A 
 Initiators Top A&A 
 Receivers

Initiator Receiver ws/s

JavaScript

slide-63
SLIDE 63

Initiators and Receivers

10

A&A Initiator #A&A
 Receivers facebook 11 google 11 doubleclick 9 youtube 8 addthis 8 hotjar 7 googlesyndication 6 twitter 5 sharethis 4 adnxs 3 A&A Receiver #A&A
 Initiators realtime 27 33across 19 intercom 16 disqus 13 zopim 12 hotjar 11 feedjit 10 lockerdome 8 inspectlet 6 smartsupp 4

Top A&A 
 Initiators Top A&A 
 Receivers

Initiator Receiver ws/s

  • Disqus provides

comment board services.

JavaScript

slide-64
SLIDE 64

Initiators and Receivers

10

A&A Initiator #A&A
 Receivers facebook 11 google 11 doubleclick 9 youtube 8 addthis 8 hotjar 7 googlesyndication 6 twitter 5 sharethis 4 adnxs 3 A&A Receiver #A&A
 Initiators realtime 27 33across 19 intercom 16 disqus 13 zopim 12 hotjar 11 feedjit 10 lockerdome 8 inspectlet 6 smartsupp 4

Top A&A 
 Initiators Top A&A 
 Receivers

Initiator Receiver ws/s

  • Disqus provides

comment board services.

  • Zopim, Intercom,

Smartsupp provide live chat services.

JavaScript

slide-65
SLIDE 65

Initiators and Receivers

10

A&A Initiator #A&A
 Receivers facebook 11 google 11 doubleclick 9 youtube 8 addthis 8 hotjar 7 googlesyndication 6 twitter 5 sharethis 4 adnxs 3 A&A Receiver #A&A
 Initiators realtime 27 33across 19 intercom 16 disqus 13 zopim 12 hotjar 11 feedjit 10 lockerdome 8 inspectlet 6 smartsupp 4

Top A&A 
 Initiators Top A&A 
 Receivers

Initiator Receiver ws/s

  • Disqus provides

comment board services.

  • Zopim, Intercom,

Smartsupp provide live chat services.

  • 33across & Lockerdome

are advertising platforms.

JavaScript

slide-66
SLIDE 66

Initiators and Receivers

10

A&A Initiator #A&A
 Receivers facebook 11 google 11 doubleclick 9 youtube 8 addthis 8 hotjar 7 googlesyndication 6 twitter 5 sharethis 4 adnxs 3 A&A Receiver #A&A
 Initiators realtime 27 33across 19 intercom 16 disqus 13 zopim 12 hotjar 11 feedjit 10 lockerdome 8 inspectlet 6 smartsupp 4

Top A&A 
 Initiators Top A&A 
 Receivers

Initiator Receiver ws/s

  • Disqus provides

comment board services.

  • Zopim, Intercom,

Smartsupp provide live chat services.

  • 33across & Lockerdome

are advertising platforms.

  • Inspectlet & Hotjar are

session replay services.

JavaScript

slide-67
SLIDE 67

Sent Items Over Web Sockets

11

slide-68
SLIDE 68

Sent Items Over Web Sockets

11

Cookie IP User IDs Fingerprinting 
 Variables DOM

% Requests

20 40 60 80

WebSockets HTTP/S

slide-69
SLIDE 69

Sent Items Over Web Sockets

11

  • Stateful Identifiers like Cookie and User IDs

Cookie IP User IDs Fingerprinting 
 Variables DOM

% Requests

20 40 60 80

WebSockets HTTP/S

slide-70
SLIDE 70

Sent Items Over Web Sockets

11

  • Stateful Identifiers like Cookie and User IDs
  • Fingerprinting data in ~3.4% WebSockets. 


97% is 33across

Cookie IP User IDs Fingerprinting 
 Variables DOM

% Requests

20 40 60 80

WebSockets HTTP/S

slide-71
SLIDE 71

Sent Items Over Web Sockets

11

  • Stateful Identifiers like Cookie and User IDs
  • Fingerprinting data in ~3.4% WebSockets. 


97% is 33across

  • ~1.6% WebSockets sends the entire DOM to 


Hotjar, LuckyOrange, TruConversion

Cookie IP User IDs Fingerprinting 
 Variables DOM

% Requests

20 40 60 80

WebSockets HTTP/S

slide-72
SLIDE 72

12

Received Items Over Web Sockets

slide-73
SLIDE 73

12

Received Items Over Web Sockets

HTML JSON JavaScript Images

% Responses

10 20 30 40 50

WebSockets HTTP/S

slide-74
SLIDE 74

12

Received Items Over Web Sockets

HTML JSON JavaScript Images

% Responses

10 20 30 40 50

WebSockets HTTP/S

slide-75
SLIDE 75

12

Received Items Over Web Sockets

HTML JSON JavaScript Images

% Responses

10 20 30 40 50

WebSockets HTTP/S

slide-76
SLIDE 76

12

Received Items Over Web Sockets

Ads served from Lockerdome

HTML JSON JavaScript Images

% Responses

10 20 30 40 50

WebSockets HTTP/S

slide-77
SLIDE 77

Summary

  • ~67% of socket connections are initiated or received by A&A domains.
  • Major companies like Google, Facebook, Addthis adopted WebSockets. 


Abandoned after Chrome 58 was released.

  • The culprits:
  • 33across was harvesting fingerprinting data.
  • DOM exfiltration by HotJar, LuckyOrange, TruConversion
  • Lockerdome downloaded URLs to serve ads.
  • We need to keep up with the current practices of A&A companies.

13

slide-78
SLIDE 78

Summary

  • ~67% of socket connections are initiated or received by A&A domains.
  • Major companies like Google, Facebook, Addthis adopted WebSockets. 


Abandoned after Chrome 58 was released.

  • The culprits:
  • 33across was harvesting fingerprinting data.
  • DOM exfiltration by HotJar, LuckyOrange, TruConversion
  • Lockerdome downloaded URLs to serve ads.
  • We need to keep up with the current practices of A&A companies.

13

Questions?

ahmad@ccs.neu.edu

slide-79
SLIDE 79

Backup Slides

slide-80
SLIDE 80

Inclusion Chain

15

<html> <body> <script src=“tracker/script.js” </script> <img src=“tracker/img.jpg”> </img> <script src=“ads/script.js”> </script> <iframe src=“frame.html”> <html> <body> <script src=“script_12.js”> </script> <img src=“img_a.jpg”> </img> </body> </html> </iframe> </body> </html> pub/ index.html tracker/ script.js tracker/ img.jpg ads/ script.js ads/ frame.html ads/ script_12.js ads/ img_a.jpg adnet/ data.ws

Source code for ads/script_12.js
 
 let ws =
 new WebSocket(“ws://adnet/data.ws”, …);
 ws.onopen = function (e) {ws.send(“…”);}

DOM Tree Inclusion Tree